CVE-2017-7481
- Source
- https://cve.org/CVERecord?id=CVE-2017-7481
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7481.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2017-7481
- Aliases
- Downstream
DEBIAN (1)
MGASA (1)
openSUSE (9)
SUSE (1)
UBUNTU (1)
- Related
- Published
- 2018-07-19T13:29:00Z
- Modified
- 2026-10-20T10:50:09Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "16.04" }, { "last_affected": "16.04" }, { "introduced": "18.04" }, { "last_affected": "18.04" }, { "introduced": "19.04" }, { "last_affected": "19.04" } ], "source": "CPE_STRING" } ], "vendor_product": "canonical:ubuntu_linux" }, { "cpes": [ "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "9.0" }, { "last_affected": "9.0" } ], "source": "CPE_STRING" } ], "vendor_product": "debian:debian_linux" }, { "cpes": [ "cpe:2.3:a:redhat:gluster_storage:3.2:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "3.2" }, { "last_affected": "3.2" } ], "source": "CPE_STRING" } ], "vendor_product": "redhat:gluster_storage" }, { "cpes": [ "cpe:2.3:a:redhat:openshift_container_platform:3.3:*:*:*:*:*:*:*", "cpe:2.3:a:redhat:openshift_container_platform:3.4:*:*:*:*:*:*:*", "cpe:2.3:a:redhat:openshift_container_platform:3.5:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "3.3" }, { "last_affected": "3.3" }, { "introduced": "3.4" }, { "last_affected": "3.4" }, { "introduced": "3.5" }, { "last_affected": "3.5" } ], "source": "CPE_STRING" } ], "vendor_product": "redhat:openshift_container_platform" }, { "cpes": [ "cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*", "cpe:2.3:a:redhat:openstack:11:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "10" }, { "last_affected": "10" }, { "introduced": "11" }, { "last_affected": "11" } ], "source": "CPE_STRING" } ], "vendor_product": "redhat:openstack" }, { "cpes": [ "cpe:2.3:a:redhat:storage_console:2.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "2.0" }, { "last_affected": "2.0" } ], "source": "CPE_STRING" } ], "vendor_product": "redhat:storage_console" }, { "cpes": [ "cpe:2.3:a:redhat:virtualization:4.1:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "4.1" }, { "last_affected": "4.1" } ], "source": "CPE_STRING" } ], "vendor_product": "redhat:virtualization" }, { "cpes": [ "cpe:2.3:a:redhat:virtualization_manager:4.1:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "4.1" }, { "last_affected": "4.1" } ], "source": "CPE_STRING" } ], "vendor_product": "redhat:virtualization_manager" } ] }- References
-
- http://www.securityfocus.com/bid/98492
- https://access.redhat.com/errata/RHSA-2017:1244
- https://access.redhat.com/errata/RHSA-2017:1334
- https://access.redhat.com/errata/RHSA-2017:1476
- https://access.redhat.com/errata/RHSA-2017:1499
- https://access.redhat.com/errata/RHSA-2017:1599
- https://access.redhat.com/errata/RHSA-2017:2524
- https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html
- https://usn.ubuntu.com/4072-1/
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7481
- https://github.com/ansible/ansible/commit/ed56f51f185a1ffd7ea57130d260098686fcc7c2
Affected packages
Git / github.com/ansible/ansible
Affected ranges
- Type
- GIT
- Repo
- https://github.com/ansible/ansible
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*", "range": [ { "introduced": "0" }, { "fixed": "2.3.1.0" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*", "range": [ { "introduced": "2.3.2.0" }, { "fixed": "2.4.0.0" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "ed56f51f185a1ffd7ea57130d260098686fcc7c2" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
0.*
0.0.1
0.01
0.3
0.7
v1.*
v1.0
v1.1
v1.2
v1.4.0
v1.6.0
v2.*
v2.0.0-0.1.alpha1
v2.0.0-0.2.alpha2
v2.0.0-0.3.beta1
v2.0.0-0.4.beta2
v2.0.0-0.5.beta3
v2.3.0.0-0.1.rc1
v2.3.0.0-0.2.rc2
v2.3.0.0-0.3.rc3
v2.3.0.0-0.4.rc4
v2.3.0.0-0.5.rc5
v2.3.0.0-0.6.rc6
v2.3.0.0-1
v2.3.1.0-0.1.rc1
v2.3.1.0-0.2.rc2